A team may trust a globally installed task and still open an untrusted repository before running it. The mise flaw concerned the default interpreter arguments inherited by that task. Repository-local configuration could set shell argument options intended to come exclusively from a trusted global source, allowing a project to influence how the supposedly…
Inspect the ClaimsCase · DiggingBeagle record
mise trusted tasks inherited interpreter options from an untrusted repository
Repository-local mise configuration could influence shell flags for trusted global tasks, transferring authority across configuration trust levels.
Scope
mise through 2026.7.13 on setups executing global tasks while reading untrusted project configuration; patched in 2026.7.14. Source-level finding, not independently verified real victim execution.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Impact
- Band 2 of 4
- Evidence
- Grade B
- Remediation
- fixed reported
- AI role
- AGAINST AI
Basis and provenance
GHSA-g74g-rg72-j2p3 provides the missing global-only denylist analysis for shell argument defaults and records the 2026.7.14 fix. The original issue did not independently execute a complete exploit chain; the score reflects reachable configuration-to-command influence with execution prerequisites.
Impact basis: Repository-local configuration could affect interpreter flags for trusted global task execution. It is a plausible code execution boundary given the affected task invocation, but a fully reproduced victim compromise is not documented.
Assessed Oct 19, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-MISE-LOCAL-CONFIG-SHELL · CVE-2026-103929: untrusted mise local config overrides default shell arguments
At a glance
This is a configuration-authority crossover rather than a language-model prompt injection. The relevant question is which file defines the command process that actually runs.
Read the implicationsThe researcher described the source-level bug but did not establish a full remote exploitation chain against a victim. The vendor patched the configuration restriction in 2026.7.14.
Limits and uncertaintyFull account
A team may trust a globally installed task and still open an untrusted repository before running it. The mise flaw concerned the default interpreter arguments inherited by that task. Repository-local configuration could set shell argument options intended to come exclusively from a trusted global source, allowing a project to influence how the supposedly trusted command was interpreted.
The crossing takes place before ordinary task code begins. An agent that invokes a familiar global task could therefore execute under interpreter options partly chosen by the repository it had just encountered. This is a configuration provenance failure rather than a model producing an explicitly hostile command, and it remains relevant even when the language model behaves as instructed.
The advisory identifies four corresponding Unix and Windows shell-argument settings and marks 2026.7.14 as fixed. Its original researcher did not publish a complete end-to-end exploitation trace in a production environment. Testing should compare the resolved command line for trusted global tasks under a benign and a hostile local configuration, including the exact configuration precedence applied after the fix.
Claims & evidence
CLM-MISE-LOCAL-CONFIG-SHELLmise versions through 2026.7.13 allowed repository-local configuration to alter shell argument defaults that were intended to come only from trusted global configuration.supported
Basis: reported finding
- supportsCVE-2026-103929: untrusted mise local config overrides default shell argumentsprimary disclosure
Description; affected and patched versions
Implications
This is a configuration-authority crossover rather than a language-model prompt injection. The relevant question is which file defines the command process that actually runs.
Controls and mitigations
- Read interpreter and shell arguments only from the trusted configuration tier when executing global or privileged tasks.
Unknowns and contradictions
- The researcher described the source-level bug but did not establish a full remote exploitation chain against a victim. The vendor patched the configuration restriction in 2026.7.14.
Sources and citation
Material revision history
- Oct 19, 2026 · Published version · first publication · revision 174
- Oct 19, 2026 · Canonical change recorded · material revision · revision 175Public fields changed: assessment_profile